From 9442d8af674c80a2f8a7358977e1fc7ed43d2776 Mon Sep 17 00:00:00 2001 From: Zhenzhong Duan Date: Wed, 22 May 2024 12:39:56 +0800 Subject: [PATCH] vfio/display: Fix error path in call site of ramfb_setup() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit vfio_display_dmabuf_init() and vfio_display_region_init() calls ramfb_setup() without checking its return value. So we may run into a situation that vfio_display_probe() succeed but errp is set. This is risky and may lead to assert failure in error_setv(). Cc: Gerd Hoffmann Fixes: b290659fc3d ("hw/vfio/display: add ramfb support") Signed-off-by: Zhenzhong Duan Reviewed-by: Cédric Le Goater Signed-off-by: Cédric Le Goater --- hw/vfio/display.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/vfio/display.c b/hw/vfio/display.c index fe624a6c9b..d28b724102 100644 --- a/hw/vfio/display.c +++ b/hw/vfio/display.c @@ -361,6 +361,9 @@ static int vfio_display_dmabuf_init(VFIOPCIDevice *vdev, Error **errp) vdev); if (vdev->enable_ramfb) { vdev->dpy->ramfb = ramfb_setup(errp); + if (!vdev->dpy->ramfb) { + return -EINVAL; + } } vfio_display_edid_init(vdev); return 0; @@ -488,6 +491,9 @@ static int vfio_display_region_init(VFIOPCIDevice *vdev, Error **errp) vdev); if (vdev->enable_ramfb) { vdev->dpy->ramfb = ramfb_setup(errp); + if (!vdev->dpy->ramfb) { + return -EINVAL; + } } return 0; }